Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
-
Size
712KB
-
MD5
4cb9bcaac6fa3716cbc03cd6f9c9cbce
-
SHA1
5e09ee52ecbf350616f78b2da4e3e41e722a875b
-
SHA256
379ce5249961879409fb36d9a1ae300a095061370afee9d2c67c58ca23c0b984
-
SHA512
7edbb413517726f950f34100382014462c9107c91c06d98b1fa2c267bee6b1b968490b82a04257065dc256778f7fa4af6c38553939fed34f5fb4fc3219b16b87
-
SSDEEP
12288:FU5rCOTeiD363pnFp4+TE2zUrNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDSpnFi+TxUrNnCvq5TJLCvY90DA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3656 8D7B.tmp 2396 8E07.tmp 1332 8E84.tmp 3080 8EF2.tmp 1544 8F4F.tmp 432 8FAD.tmp 4712 901A.tmp 4924 9078.tmp 4840 90D6.tmp 4948 9153.tmp 4008 91E0.tmp 1688 925D.tmp 2308 92DA.tmp 2952 9337.tmp 1724 9395.tmp 3512 9422.tmp 5020 949F.tmp 2780 950C.tmp 4820 9579.tmp 2288 95E7.tmp 3752 9654.tmp 4852 96B2.tmp 64 972F.tmp 544 97AC.tmp 1508 9819.tmp 1484 9877.tmp 3516 9904.tmp 536 9971.tmp 2616 99CF.tmp 1096 9A2D.tmp 908 9A8A.tmp 1852 9B07.tmp 4124 9B75.tmp 2328 9BD2.tmp 3612 9C30.tmp 3588 9C8E.tmp 1164 9CDC.tmp 4460 9D3A.tmp 4428 9D88.tmp 1340 9DD6.tmp 3004 9E34.tmp 4976 9E82.tmp 2844 9ED0.tmp 4980 9F2E.tmp 5104 9F8C.tmp 3292 9FDA.tmp 1468 A028.tmp 364 A076.tmp 2240 A0D4.tmp 4512 A131.tmp 2164 A180.tmp 1124 A1CE.tmp 4360 A21C.tmp 3828 A27A.tmp 1760 A2C8.tmp 4720 A325.tmp 4496 A374.tmp 4516 A3D1.tmp 4644 A42F.tmp 4700 A47D.tmp 2980 A4DB.tmp 392 A539.tmp 2024 A596.tmp 1612 A5E5.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A028.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C86C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C966.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 943C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 3656 1340 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 84 PID 1340 wrote to memory of 3656 1340 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 84 PID 1340 wrote to memory of 3656 1340 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 84 PID 3656 wrote to memory of 2396 3656 8D7B.tmp 86 PID 3656 wrote to memory of 2396 3656 8D7B.tmp 86 PID 3656 wrote to memory of 2396 3656 8D7B.tmp 86 PID 2396 wrote to memory of 1332 2396 8E07.tmp 88 PID 2396 wrote to memory of 1332 2396 8E07.tmp 88 PID 2396 wrote to memory of 1332 2396 8E07.tmp 88 PID 1332 wrote to memory of 3080 1332 8E84.tmp 90 PID 1332 wrote to memory of 3080 1332 8E84.tmp 90 PID 1332 wrote to memory of 3080 1332 8E84.tmp 90 PID 3080 wrote to memory of 1544 3080 8EF2.tmp 91 PID 3080 wrote to memory of 1544 3080 8EF2.tmp 91 PID 3080 wrote to memory of 1544 3080 8EF2.tmp 91 PID 1544 wrote to memory of 432 1544 8F4F.tmp 93 PID 1544 wrote to memory of 432 1544 8F4F.tmp 93 PID 1544 wrote to memory of 432 1544 8F4F.tmp 93 PID 432 wrote to memory of 4712 432 8FAD.tmp 94 PID 432 wrote to memory of 4712 432 8FAD.tmp 94 PID 432 wrote to memory of 4712 432 8FAD.tmp 94 PID 4712 wrote to memory of 4924 4712 901A.tmp 95 PID 4712 wrote to memory of 4924 4712 901A.tmp 95 PID 4712 wrote to memory of 4924 4712 901A.tmp 95 PID 4924 wrote to memory of 4840 4924 9078.tmp 96 PID 4924 wrote to memory of 4840 4924 9078.tmp 96 PID 4924 wrote to memory of 4840 4924 9078.tmp 96 PID 4840 wrote to memory of 4948 4840 90D6.tmp 97 PID 4840 wrote to memory of 4948 4840 90D6.tmp 97 PID 4840 wrote to memory of 4948 4840 90D6.tmp 97 PID 4948 wrote to memory of 4008 4948 9153.tmp 98 PID 4948 wrote to memory of 4008 4948 9153.tmp 98 PID 4948 wrote to memory of 4008 4948 9153.tmp 98 PID 4008 wrote to memory of 1688 4008 91E0.tmp 99 PID 4008 wrote to memory of 1688 4008 91E0.tmp 99 PID 4008 wrote to memory of 1688 4008 91E0.tmp 99 PID 1688 wrote to memory of 2308 1688 925D.tmp 100 PID 1688 wrote to memory of 2308 1688 925D.tmp 100 PID 1688 wrote to memory of 2308 1688 925D.tmp 100 PID 2308 wrote to memory of 2952 2308 92DA.tmp 101 PID 2308 wrote to memory of 2952 2308 92DA.tmp 101 PID 2308 wrote to memory of 2952 2308 92DA.tmp 101 PID 2952 wrote to memory of 1724 2952 9337.tmp 102 PID 2952 wrote to memory of 1724 2952 9337.tmp 102 PID 2952 wrote to memory of 1724 2952 9337.tmp 102 PID 1724 wrote to memory of 3512 1724 9395.tmp 103 PID 1724 wrote to memory of 3512 1724 9395.tmp 103 PID 1724 wrote to memory of 3512 1724 9395.tmp 103 PID 3512 wrote to memory of 5020 3512 9422.tmp 104 PID 3512 wrote to memory of 5020 3512 9422.tmp 104 PID 3512 wrote to memory of 5020 3512 9422.tmp 104 PID 5020 wrote to memory of 2780 5020 949F.tmp 105 PID 5020 wrote to memory of 2780 5020 949F.tmp 105 PID 5020 wrote to memory of 2780 5020 949F.tmp 105 PID 2780 wrote to memory of 4820 2780 950C.tmp 106 PID 2780 wrote to memory of 4820 2780 950C.tmp 106 PID 2780 wrote to memory of 4820 2780 950C.tmp 106 PID 4820 wrote to memory of 2288 4820 9579.tmp 108 PID 4820 wrote to memory of 2288 4820 9579.tmp 108 PID 4820 wrote to memory of 2288 4820 9579.tmp 108 PID 2288 wrote to memory of 3752 2288 95E7.tmp 109 PID 2288 wrote to memory of 3752 2288 95E7.tmp 109 PID 2288 wrote to memory of 3752 2288 95E7.tmp 109 PID 3752 wrote to memory of 4852 3752 9654.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"23⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"24⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"25⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"27⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"28⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"29⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"30⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"31⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"32⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"33⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"34⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"35⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"37⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"38⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"39⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"41⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"42⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"43⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"44⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"45⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"46⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"47⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"49⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"50⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"51⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"52⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"53⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"54⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"55⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"56⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"57⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"58⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"59⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"60⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"61⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"62⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"63⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"64⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"65⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"66⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"68⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"69⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"70⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"71⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"72⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"73⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"74⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"75⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"76⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"77⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"78⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"79⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"80⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"81⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"82⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"83⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"85⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"86⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"87⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"88⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"89⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"90⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"91⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"93⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"94⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"95⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"96⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"98⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"100⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"101⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"102⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"103⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"104⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"105⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"106⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"107⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"108⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"110⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"111⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"112⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"113⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"114⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"116⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"117⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"118⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"119⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"120⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"121⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"122⤵PID:3828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-